Close the vscode ledger tail: bounded propagation tiers for the defuse linker

[rahlk]

Plan

docs/design/specs/defuse-linker-call-graph.md (the staged follow-up it names) + the audited tail in docs/design/specs/defuse-linker-joern-ledger.md. Python precedent: codeanalyzer-python #150 (whole-program propagation, capped and deterministic).

Problem

The vscode Joern audit (#98) plateaued at 99.66% with a 189-pair classified residual. The families with mechanical closes: object-literal callback properties invoked through parameters (settingsTree onChange), chained factory returns, Registry-pattern generics, getter-returned function invocation — plus Promise-executor name-shadows that are Joern fabrications needing parameter-name proof in the comparator rather than analyzer work.

Scope boundary

L2 recall only; no schema shape, prov vocabulary, id, or CLI change. NOT in scope: the static/instance same-name signature collision (id-grammar change — design mode) and unbounded whole-program fixpoints (bounded rounds only, python #150 style).

Goals

• Comparator: dump Joern method parameter names; classify residual pairs whose target leaf-name matches a caller parameter as their parameters-as-callees family (proof, not waiver)
• T4a extension: property-invoking param sites (template.onChange(...) where template is a parameter) vote over object-literal properties passed at that position
• T4b: chained return summaries, one internal level, memoized (python's chained-returns transfer)
• Investigate + fix the Registry-generics and getter-invocation families (shapes pass in isolation; find the vscode-context breaker)
• Re-run the corpus gate (must stay 74/74, residual 0) and the vscode audit; update the ledger
• A/B determinism gate stays byte-identical

Caveats and known risks

• Bounded tiers may widen edges (votes over literals are may-call); every new tier stays deterministic (sorted iteration) and is measured against the corpus gate before vscode.
• The static-collision family (11) remains open by design — tracked for a design-mode session, not silently absorbed here.

Definition of done

• vscode residual < 100 with every remaining pair in a proven-fabrication or design-gated class; corpus residual 0; suite/typecheck/determinism green; ledger updated with the round history; PR stacked on feat(callgraph)!: replace Jelly with the defuse linker — tsc + per-callable tiers #99.